Typically, computer viruses may be periodically scanned for and terminated by an antivirus engine or application. Such actions may inhibit the viruses from growing to or beyond a certain extent. When the ability of the antivirus engine to scan for and terminate a type of virus substantially deviates from an original trend in a very short period, it may indicate the possible presence of the following abnormal conditions: in the case of a dramatically increased amount of this type of virus being found and terminated, may indicate that this type of virus is likely to break out on a large scale in a short period; and in the case of a dramatically decreased amount of this type of virus being found and terminated, may indicate that the ability of the antivirus engine to identify this type of virus might have been degraded and even invalidated or that this type of virus might have been mutated. In order to prevent the virus from breaking out on a large scale, it is of great significance to effectively monitor a development trend of the virus to identify such an abnormality and further to issue a timely alarm upon detection of the abnormality in the development trend of the virus.
In general, when there are a few types of viruses, a technician may subjectively determine whether the development trends of the viruses are abnormal as per his experience. However, with a dramatically increased number, e.g., tens of hundreds, of types of viruses, manual monitoring of the development trends of the viruses for an abnormality may consume considerable labor and further may not be effective.
Accordingly a method to detect a developing trend of a virus may be based upon the number of virus samples or based on an increase in number of virus samples. In this method, a corresponding threshold may be set for each virus, and whether the development trend of the virus is abnormal is determined by monitoring whether the number of virus samples exceeds the threshold or by monitoring whether an increase in number of virus samples exceeds the threshold. However, a new virus or a mutated virus may not be detected effectively in a timely manner.